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Abstract 

For every NAND formula of size N, there is a bounded-error N 3+°( 1 )-timc quantum al- 
gorithm, based on a coined quantum walk, that evaluates this formula on a black-box input. 
Balanced, or "approximately balanced," NAND formulas can be evaluated in 0(y/~N) queries, 
which is optimal. It follows that the (2 — o(l))-th power of the quantum query complexity is 
a lower bound on the formula size, almost solving in the positive an open problem posed by 
Laplante, Lee and Szegedy. 



1 Introduction 

Consider a formula <p on TV inputs xi, . . . ,xn, using the gate set S either {AND, OR, NOT} or 
equivalently {NAND}. That is, the formula p> corresponds to a tree where each internal node is 
a gate from S on its children. If the same variable is fed into different inputs of p, we treat each 
occurrence separately, so that N counts variables with multiplicity. The variables %i are accessed by 
querying a quantum oracle, which we can take to be the unitary operator O x : \b,i) i— > (—l) bXi \b, i), 
for b £ {0, 1} and i E {1, . . . , A^} the control qubit and query index, respectively. We will show: 

Theorem 1. After efficient preprocessing (i.e., preprocessing taking poly (N) steps) of the formula 
<p independent of x, <p{x) can be evaluated with error < 1/3 using A^2+°( 1 ) time and queries to O x . 

Our algorithm is inspired by the recent A r 2+°( 1 )-time algorithm of Farhi, Goldstone and Gut- 
mann [FGG07j for the case in which 5 = {NAND}, each NAND gate in p has exactly two inputs 
and ip is balanced — i.e., N = 2™ and p has depth n. Our algorithm requires no preprocessing in 
this special case of a balanced binary NAND tree. For a balanced, or even an "approximately 
balanced" NAND tree, our algorithm requires only 0(y/~N) queries (jTheorem 9p . which is optimal. 
The correctness of our algorithm will turn on spectral analysis of a Hamiltonian similar to that 
simulated by Farhi et ah, except in general weighted according to the formula's imbalances. 

Our algorithm (almost) solves in the positive the open problem posed by Laplante, Lee and 
Szegedy jLLS06j . whether the quantum query complexity squared is a lower bound on the formula 
size. ITheorem 11 implies that the formula size of a function / is at least Q2(f) 2 ~°^ ■ Note too that 
evaluating an AND-OR tree is the decision version of evaluating a MIN-MAX tree. 
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Figure 1: The balanced binary NAND formula ip = ((xi A X2) A(x3 A £4)) A ((0:5 A Xq) A(cc7 A xs)) — where 
a A b = (a A 6) — is represented by the balanced subtree rooted at r. The input is fed in at the leaves (top 
row), and internal vertices are evaluated as NAND gates on their children. Here a vertex v is filled or not 
according to whether its evaluation 7\(v) is 1 or 0, respectively; in this example, the input is x = 00010111 
and overall, <p(x) = A(r) = 1. Below r, we have additionally attached two vertices, r' and r". Modify the 
classical uniform random walk on this tree by marking leaf vertices evaluating to 1 as probability sinks, and 
adding a certain bias to the coin flip at r'. Then the corresponding quantum walk can be used to evaluate 
the formula in 0(-\f~N) time. 



Idea of the algorithm 



Associated to the NAND formula <p is a tree T = T{ip). |Figure 1 gives an example of a balanced 



binary tree; the formal construction in the general case is in ISection ~2l Consider the classical 
uniform random walk on this tree; at vertex v with degree d(v), flip an unbiased <i(v)-sided "coin" 
to decide which neighbor to step to next. (The coin at r' will have a certain bias, as will all coins 
in the case of an unbalanced tree.) Incorporate the input into the walk by making all vertices 
evaluating to 1 into probability sinks. 

The corresponding quantum walk U works on a vertex register and a coin register. Instead of 
randomizing the coin register between steps, a Grover diffusion operator is applied to the coin. This 
quantum walk U, started at r" , can be used with phase estimation to evaluate a general NAND 
formula in only A^2+°( 1 ) time, or 0{\J~N) queries in the balanced or approximately balanced case. 
The general algorithm is described in ISection 61 while Figure 2 presents the full algorithm for the 
balanced case. 

The correctness proof uses Szegedy's correspondence between classical random walks and 
discrete-time quantum walks ([Theorem 7|h Note that Szegedy's formulation can also be viewed as 
establishing a correspondence between discrete- and continuous-time quantum walks (jRemark 2[) . 
In particular, the spectrum and eigenvectors of the coined walk unitary can be related to those of 
the Hamiltonian for a continuous-time quantum walk on a closely related tree. 



History of the problem 

Grover showed in 1996 |Gro96l IGro02) how to search a general unstructured database of size N, 
represented by a black-box oracle function, in 0{s/N) oracle queries and 0(y/~N log log N) time 
on a quantum computer. His search algorithm can be used to compute the logical OR of bits 
in the same time; simply search for a 1 in the input string. Since Grover search can be used as 
a subroutine, even within another instance of Grover search, one can speed up the computation 
of more general logical formulas. For example, a two-level AND-OR tree (with one AND gate of 
fan-in \A7V and y/~N OR gates of the same fan-in as its children) can be computed in 0(y/~N log N) 
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queries. Here the log factor comes from amplifying the success probability of the inner quantum 
search to be polynomially close to one, so that the total error is at most constant. By iterating the 
same argument, regular AND-OR trees of depth d can be evaluated with constant error in time 
s/N -0{\ogN) d - 1 |BCW98j . 

H0yer, Mosca and de Wolf [HMW03] showed that Grover search can be applied even if the 
input variables are noisy, so the log-factor is not necessary. Consequently, a depth-d AND-OR tree 
can be computed in 0(y/N ■ c d ) queries, where c is a constant that comes from their algorithm. 
It follows that constant-depth AND-OR trees can be computed in 0(y/~N) queries. Unfortunately, 
their algorithm is too slow for the balanced binary AND-OR tree of depth log 2 N (although it does 
give some speedup for sufficiently large constant fan- ins). 

Classically, using a technique called alpha-beta pruning, one can compute the value of a balanced 
binary AND-OR tree with zero error in expected time 0{N lo ^K 1 +^)/ 4 i) = 0{N - 754 ) |Sni85L 
ISW86] . and this is optimal even for bounded-error algorithms |San95j . 

For a long time, no quantum algorithm was known that performed better than the classical zero- 
error algorithm, despite the fact that the best known lower bound, from the adversary method, is 
only Q(y/~N) |BS04j . Very recently, Farhi, Goldstone and Gutmann |FGG07| presented a ground- 
breaking quantum algorithm for the balanced case, based on continuous-time quantum walks. Their 
algorithm runs in time 0(y/~N) in an unconventional, continuous-time query model. Childs, Cleve, 
Jordan and Yeung [CCJY07] shortly after pointed out that this algorithm can be discretized into 
the conventional oracle query model with a small slowdown, to run in time A^2+°( 1 ). 



After a previous version of our paper [CRSZ07] was distributed on the preprint arXiv, Ambai- 



ms |Amb07aj gave an 0(\/]V) -query algorithm for evaluating balanced binary AND-OR trees. This 
is optimal in the number of oracle queries, and may also be efficiently implementable [Amb07b] . 



Organization 

ISection "2l defines and puts weights on the tree T(tp). The weights of edges to the leaves depend 
on the input x. ISection "3l shows that when <p(x) = 0, there exists a zero-energy eigenstate (i.e., 
eigenvector with eigenvalue zero) of the weighted adjacency matrix of T{ip) and a short tail, having 
substantial overlap with a known initial state. Conversely, if <p(x) = 1, then any zero-energy 
eigenstates can be neglected, as they have no overlap on the initial state. In the case (p(x) = 1, 
ISection "4l shows that eigenvectors with small nonzero eigenvalues can also be neglected. This is 
argued by connecting the NAND formula's evaluation to the ratio of amplitudes from a child to 
its parent. We then construct an algorithm using the observations of Sections [3] and [U ISection "51 
reviews Szegedy's theorem relating the spectrum and eigenvectors of a coined quantum walk to those 
of the Hamiltonian for a continuous-time quantum walk. We apply this relationship in ISection "HI 
to show that phase estimation on a certain coined quantum walk can be used to evaluate cp. 



2 Weighted NAND formula tree 

Consider a NAND formula of size N — i.e., on N variables, counting multiplicity. (The NAND gate 
on inputs yi,-.-,yk £ {0, 1} evaluates to 1 — Y\i=i Hi- ^ n particular, the NAND gate on a single 
input is simply the NOT gate.) 

Represent the formula tp by a rooted tree T = T(tp), in which the leaves correspond to variables, 
and other vertices correspond to NAND gates on their children. (Because ip is a formula, not a 
circuit, each gate has fan-out one, so there are no loops in the associated graph.) Attach below the 



root r a "tail" of two vertices r' and r" as in Figure 1 
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1. Initialization. Let T = 320 [v N\. Prepare three quantum registers in the state 

T-l 



^EH)^))®lO|left) • 



The first register is a counter for quantum phase estimation, the second register holds 
a vertex index, and the third register is a qutrit "coin" holding 'down', 'left' or 'right' 
in this order. 

2. Quantum walk. If the first register is \t), perform t steps of the following discrete- 
time coined quantum walk U. Denote the last two registers by |f)|c). 

• Diffusion step. 

(a) If v is a leaf, apply a phase flip (— l) Xv using one controlled call to the input 
oracle. 

(b) If v is an internal degree-three vertex, apply the following diffusion operator 
on coin \c): 

/-1/3 2/3 2/3 
Reflection^) = 2\u)(u\ -I = 2/3 -1/3 2/3 

\ 2/3 2/3 -1/3, 

where \u) = -^(|down) + (left) + | right)) = ^-(1, 1, l) r . 

(c) If v = r' , apply the following diffusion operator on \c): 



Reflection^/) = 2\u')(u'\ — I 



( 2 /^- - A- \ 

y/W N 

2 r±- - J- 1 - -2- 

V o o-iy 



where \u>) = ^|down) + ^1 - ^|left). 
(d) If v = r" , do nothing. 
• Walk step. 

(a) If c = 'down', then walk down to the parent of v and set c to either 'left' or 
'right' depending on which child v is. 

(b) If c E {'left', 'right'}, then walk up to the corresponding child of v and set c 
to 'down'. 

Note that the walk step operator is a permutation that simply flips the direction 
of each oriented edge. 

3. Quantum phase estimation. Apply the inverse quantum Fourier transform (mod- 
ulo T) on the first register and measure it in the computational basis. Return if and 
only if the outcome is or % . 



Figure 2: An optimal quantum algorithm to evaluate the balanced binary NAND formula using 0{s/N) 
queries. The algorithm runs quantum phase estimation on top of the quantum walk of |Figure~Tj 
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Definition 1. For a vertex v, let s v be the number of inputs to the subformula under v, counting 
multiplicity (in particular s r = s r > = s r » = N). Let 7\(v) denote the value of the subformula at v 
(7\(r) = A(r") = <p(x)). 

Definition 2. Let H be a symmetric, weighted adjacency matrix of the graph consisting of T and 
the attached tail: 

H\v) = h pv \p) + } u h vc \c) , (1) 

c 

where p is the parent of v and the sum is over v's children. (If v has no parent or no children, the 
respective terms are zero.) The edge weights depend on the structure of the tree, and are given by 

V=(-) 1/4 > (2) 



with two exceptions: 

1. If a leaf v evaluates to A(v) = 1, set h pv = 0, i.e., effectively remove the edge (p,v) by setting 
its weight to zero. 

2. Set hr» r > = l/( v / cr„(r)iV 1 /4) (see \Definitib~n~U\) . 

Definition 3. To track error terms through the analysis, it will be helpful to define 

<r_ (v) = max ^2 

~(w)=0 

cr+(v) = max ^ s w 

A(to) = l 

with the maximum in each case taken over all paths £ from v up to a leaf. Letting d r be the depth 
of r, clearly cr_(u) < o"_(r) < d r and o~+(v) < cr+(r) < Nd r ^ We call formula tp "approximately 
balanced" if <r_(r) = 0(1), a+(r) = O(N) and \\H\\ = \\H\\ 2 = O(l). 

Our algorithm will depend on the following properties of H , which we will prove in the following 
two sections: 

Theorem 2. If <p(x) = 0, then there exists \a) a zero-energy eigenvector of H , with |||a)|| = 1 
and overlap (r"\a) > If tp{x) = 1, then every eigenvector with support on r' or r" has 

corresponding eigenvalue at least 1 , in absolute value. 

9°"- 0*)v°"+( r ) 

Remark 1. For a leaf v evaluating to 0, it is sufficient that h pv satisfy h pv > l/s^ 4 . One can 

also verify {Theorem H for weights h pv defined by, for an arbitrary fixed (3 > 0, h pv = s v @ / 's p 2~@ ' , 

h r /> r > = l/(A/o r_ (r)A r 2 _ ^) and cr_(u) = max^ Yl w<=£: We fix (3 = 1/4 to simplify notation. 

AO)=o 



3 Zero-energy eigenstates of H 

Recall that in a NAND tree T, internal vertices are interpreted as NAND gates on their children. 
As lDefinition 21 puts zero weight on the parental edge of a leaf evaluating to one, such leaves can be 
regarded as disconnected. All leaves connected to the root component can be interpreted as zeros. 

1 In fact, cr_(r) = 0(\/dr), because s w must increase by at least one every two levels down (two NOT gates in a 
row would be redundant). Slightly stronger bounds can be given for trees preprocessed according to the rebalancing 
procedure of lLemma 101 but poly(d r ) and poly(log iV) factors here won't significantly change the running time. 
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Q- + /3 4 



Figure 3: An example NAND tree to illustrate Lemmas [3] and 2J As in |Figurc 1| a vertex is filled or not 
according to whether it evaluates to 1 or 0, respectively. The amplitudes (v\a) of a zero-energy eigenstatc 
| a) for the adjacency matrix H are also labeled, with a, (3, 7 free variables, assuming h pv = 1 for every edge 
(p, v). The amplitudes of the neighbors of any vertex sum to zero. The existence of such an \a) is promised 
by lLcmma 41 As required bv lLemma 3| (v\a) = if 7\(v) = 1, so vertices evaluating to 1 are not labeled. 



Definition 4. By T v , we mean the subtree of T consisting of v and all its descendants. The 
restriction to T v of a vector \a) on T will be denoted |or„)- That is, for a subset S of the vertices, 
define the projector Us = X^se5 l s )( s l> then \ax v ) = IFrJa). We will also write a v for (v\a). Finally, 
let H s = Jl s H. 

Lemma 3. For an internal vertex p in NAND tree T, if7\(p) = 1 and Hx p \a) = 0, then a p = 0. 

Proof. Since A(p) = 1, there exists a child v of p having A(v) = 0. If v is a leaf, then = {v\H\a) = 
h pv a p , as asserted. Otherwise, all children c of v must have A(c) = 1, implying by induction that 
a c = 0. Then 

= {v\H\a} = h pv a p + ^ h vc a c = h pv a p , 

c 

as asserted. □ 

ILemma~3l constrains the existence of zero-energy eigenstates supported on the root r when 
the NAND formula evaluates to 1. However, there may be zero-energy eigenstates that are not 



supported on the root (for example, consider the right subtree in Figure 3). 



Lemma 4. Consider a vertex p in NAND tree T. If A(p) = 0, then there exists an \a) = \clt p ) with 
H Tp \a) = 0, |||a)|| = 1, and a p > l/(y/al (p)4 /4 )- 

Proof. Since A(p) = 0, for all children v of p, A(v) = 1. So each v has a child c v satisfying A(c v ) = 0. 

Construct \a) as follows. Set a v = for all children v. Set \clt c ) = for all grandchildren 
c ^ {c v }. By induction, for each v construct \clt cV ) satisfying |||a7>)|| = 1, Ht c v \o-t c v ) = and 
a c v > l/{^fc7J^)s)l 4 ). 

For each v, in order to satisfy (?;|_H"|ct) = 0, we need h pv a p = —h vc va c v. To satisfy all these 
equations, we rescale the vectors \clt v ). Let a p = 1, and let \ar cV ) = — \ cit c v ) ■ It only 

remains to verify that |||a)|| 2 < J~s~p~o--{p), so that renormalizing, o p /|||a)|| = l/|||a)|| is still large. 
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Indeed H 



\a) || 2 = 4 + £ || | flTc „ ) || 2 a c „ > l/(y^)^ /4 ) 

S 



— hmax<T_(c") 



< y^o-_(p) . □ 

(The key step in the above proof, which motivates the choice of weights h pv , is £^ s v = s p .) 

ILemma~4l is a strong converse of ILemma~3l as it does not merely assert that a p can be set 
nonzero; it also puts a quantitative lower bound on the achievable magnitude. ILemma"4l lets us say 
that there exists an energy-zero eigenstate with large overlap with the root r when A(r) = 0. 

Now in the case (f(x) = A(r) = 0, let us extend \a,T r ) from ILemma~4l into a zero-energy 
eigenvector \a) over the whole graph, to see that the overlap K^""! )!/!!! )!! is large. In order to 
satisfy H\a) = 0, we must have a r > = and — a r » = £ r ' r a r = ^/aZ{r)N 1 / i a r > 1. Therefore, we 
lower-bound 

\(r"\a)\ > 1 _J_ 

IH a )ll " V 1 + WMW 2 V2 ' 

4 Spectral gap of H in the case ip(x) = 1 

To complete the analysis in the <p(x) = 1 case, we investigate H's eigenvectors corresponding to 
energies E close to zero. In this section, we will show 



Theorem 5. If <p(x) = A(r) = 1, then H has no eigenvector with energy \E\ S ( 0, 1 , 

V 9o-_(r) A /<T + (» 

and support on r' or r" . 

As T is a bipartite graph, H's eigenvalues are symmetric around zero. Let 

\E)=J2»v\v) 

V 

be an eigenvector of H with eigenvalue E > 0. 
Prom Eq. (1) we obtain 

(v\H\E) = Ea v = hpvCtp + ^ h v C a c ■ (4) 



c 



The analysis depends on the fact that a v /a p is either large or small in magnitude depending on 
whether A(v) = or 1. 



2 We use a note beside a line to help indicate the derivation of the next line. 
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Lemma 6. Let < E < 1 , For vertices v r" in T, define vq v and y± v by 

1 + Ec hvcVlc 
VOv = - 



yii 



hpv 



(5) 



where p is the parent of v, the sum is over children c of v, and 7^ is defined by 

7„ = r-r 2 <r_(i.)-E 2 (i + r> + (t.) (6) 
r 1 



2a-{r) 
r / = 8<7_(r) . 

(It holds that 1/V < j v < T.) Then for every vertex v ^ r" in T , either a v = a p = 0, or 

7\(v) =0 =>- < a p /a v < y 0v E 
7\(v) = 1 =>• > a v /a p > -y lv E . 



(7) 



Proof. The inequality r y v < V is trivial. To show j v > 1/T', use 1 < o~-(v) < cr_(r), o~ + (v) < <r + (r), 
and the assumed upper bound on E. 

The main proof goes by induction. Base case: for every leaf v, 7\(v) = and by Eq. |(4)[ 
Ea v = h pv a p . Thus either a v = a p = 0, or a p /a v = ^- = yo v E. Induction step: 

• If 7\(v) = 0, then all children c evaluate to A(c) = 1. First assume a v ^ 0. Dividing both 
sides of Eq. (4) by a v , using the induction hypothesis, and rearranging terms gives 



OL v tlp V V Q! l 

< t— (i + E h v C yic ) E 

tlp v \ 



The induction hypothesis also gives that a p /a v > E/h pv > 0. If a v = 0, then the induction 
hypothesis gives that all a c are zero, so also a p = by Eq. |(4)[ 



If A(v) = 1, then there is at least one child c with A(c) = 0. We may assume a v ^ since 
otherwise a v /a p = and the inequality holds trivially. Then, again dividing Eq. |(4)| by a v , 
using the induction hypothesis, and multiplying by E, 

-Eh pv — = E ^2 h vc — — E 2 
h. 



> 



£ —-E 2 (l+ £ h vc y lc ) . (8) 



c:A(c)=0 y c:A(c)=l 



Let us upper-bound the coefficient of E 2 : 



c:A(c) = l c:A(c) = l 

/ 1 \ i— 

< 1 + (max — )Jsv 

c 7c 

< (i + r')v^ , 
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where in the first inequality we used that h vc = (sc/s,,) 1 / 4 for all c evaluating to 1, and that 

X^c ^ c — ^ v ' 

Now lower-bound the first term in Eq. |(8)[ If A(c) = 0, then 



h h 1 

> l vc ""tie 



yoc i + Yld h cd,yid 

yjsc/s v 1 7 rf 

> =- = nnn ■ 



l + ^max d ^ d ^1 + -JL 



^ ■ Id , Id 
> nun — — 1 



d \J S v \ yfs~c 

where d varies over the children of c. 
Substitute these bounds back into Eq. |(8)[ 



-Eh pv — > — — 



mm ld ( l--^=) -E 2 (l + T')s v 

c,d V V^cJ 

E 2 {l + T')s v ^j 



i / r 2 

> -— mm 7 d 

yjs^u c,d \ yjs 
1 ^2 



min r — r I <j— (d) + 



This is at least h pv /y\ v = J v /y/s^ for j v defined as in Eq. |(6)[ As h pv , y\ v and E are all 
positive, we have > a v /a p > —Ey± v , as desired. □ 

Proof of \Theorem 51 Assume \E) is an eigenvector of H with energy E E (0, ?-]. We 

want to show ay = a r " = 0. 

Since A(r') = 1 — A(r) = 1 — = 0, ILemma"6l gives that either ay = a r » = or < < 
yo r >E. In the latter case, Eq. |(4)| at r" gives Ea r » = h r » r ia r i, so 



E 2 > Vv g ubgt from £q pri 
2/0r' ' ' 

fr^y Subst. Vv = 



> 



1 + h r r r yi r h T i r = 1, 7/i r = a/ZV/Tt- 

l/><I- = to_(r) 
1 + VN/ lr ,,r ~ K ' 

1 



^_(r) 2 A^ + cr_(r)\/iV 



However, this is a contradiction, because E 2 < — due to o+(r) > N and <r_(r) > 1. □ 

' ' — 81cr_(rr7V -i-w — w — 



5 Coined quantum walks 

In order to construct an algorithm from ITheorem 21 we need first to review briefly Szegedy's 
procedure for quantizing classical random walks. ITheorem 71 adapted from [Sze04], relates the 
eigensystem of the coined quantum walk to that of the original classical walk. 
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Theorem 7 ( |Sze04j ). Let {\v) : v £ V} be an orthonormal basis for TLy. For each v & V , let 
\v) = \v)®Yjw&v y/P^\w) G TLy®TLy, wherep vw > and (v\v) = J2 w p vw = 1. LetT = Y, v \v)(v\ 
and II = TT^ = Y^ v \v)(v\ be the projection onto the span of the \v)s. Let 5 = J2 VW \ v > w )( w > v \> a 
swap. Let M = T' ST = ^2 VW \v}(v\S\w)(w\ = w ^/p vw p wv \v){w\ a real symmetric matrix, and 
take {|A a )} a complete set of orthonormal eigenvectors of M with respective eigenvalues X a . 

Let U = (211 — 1)5, a swap followed by reflection about the span of the \v)s. Then the spectral 
decomposition of U is determined by that of M as follows: Let R a = span{T|A a ), 5T|A a )}. Then 
R a _L R a f for a ^ a' ; let R = ® a R a . U fixes the spaces R a and is —S on R ± . The eigenvalues and 
eigenvectors ofU within R a are given by f3 a ^± = — \ a ±isjl — and (1 + (3 a ,±S)T\X a ) , respectively. 

Proof. First assume a ^ a', and let us show R a _L R a i . Indeed, {\ a \T^T\\ a i) = (A |A ') = 0, as 
T'T = 1. Since 5 2 = 1, similarly, 5T|A a ) is orthogonal to 5T|A a '). Finally, (A a |T'5T|A a ') = 
(A a |M|A a /) = 0. Therefore, the decomposition TLy ®TLy = (©a-^a) © R 1 ' is well-defined. 

R is the span of the images of ST and T. 211 — 1 is +L on the image of T and —/on its 
complement; therefore U is —5 on R^~. 

Finally, IYT = TT^T = T and I15T = TT^ST = TM, so 

U(ST\X a )) = (211 — l)T|A a ) = T|A a ) 
U(T\\ a )) = (211 - l)5T|A a ) = (2A a - 5)T|A a ) ; 

U fixes the subspaces R a . To determine its eigenvalues on R a , let \(3) = (1 + (3S)T\X a ). Then 
U\0) = {2\ a +/3)T\\ a )-ST\\ a ) is proportional to \j3) if/3(2A a +/3) = -1; i.e., (3 G {-\a±i^/T^ a }. 
(If A a = ±1, note that T|A a ) = ±5T|A a ), so R a is one-dimensional with a single U eigenvector.) □ 

To connect this theorem to classical and quantum walks, start with an undirected graph G = 
(V,E). Choose the 

Pv,w to be the transition probabilities v — > w of a classical random walk along 
this graph (i.e., with the constraint p VjW = if (v , w) ^ E). Then U = (211 — 1)5 can be considered 
a quantization of the classical walk, taking place on the directed edges of G. First the swap 5 
switches the direction of an edge. Then, for the first register fixed to be \v), (211 — 1) acts as 
a reflection about \v) = \v) Ylw~ v \/Pv,w\u>)] it is a "coin flip" that mixes the directed edges 
leaving v. Therefore, although U acts on TLy <g> Hv, it preserves the subspace spanned by \v,w) 
and \ w, v) for (v, w) £ E. An alternative basis for this subspace is to give a vertex v together with 
an edge index to describe an edge leaving v. If the graph has bounded degree < D, then U can be 
implemented on TLy ® C D instead of TLy © TLy- 

Szegedy's Theorem 71 relates the eigenvalues and eigenvectors of the quantum walk U to that 
of the matrix M = Y^ v w ^/Pv,wPw,v\v){w\. If P = Y^ v w \/Pv,w\v){w\ is the element-wise square-root 
of the transition matrix of the original classical random walk, then M is the element-wise product 
P o P T . M can also be regarded as the Hamiltonian for a continuous-time quantum walk on the 
vertices of the underlying graph. 

Discretization of general continuous-time quantum walks 

In our case, we are given H (from [Section 2p . and desire a factorization H = P o P T such that P 
has all row norms exactly one. Then iTneorem 7l with M = H applies to relate the eigensystem of 
H to that of a certain coined quantum walk. Such a factorization is possible for a large class of 
Hamiltonians: 

Claim 8. Let H = H VjW \v)(w\ be the positive-weighted symmetric adjacency matrix of a 

connected graph G. Let \S) be the principal eigenvector of H , with (v\5) = 5 V > for every v. 

Assume \\H\\ = 1. Then H = P o P T , where P = Y2 V w \ H V)W ^f-\v){w\ has all row norms one. 
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Proof. Since H is nonnegative, the principal eigenvector |<5) is also nonnegative. Since H is con- 
nected, 5 V > for every v; hence P is well defined. By construction, P V ^ W P W ^ V = H v>w , i.e., 
P o P T = H. Furthermore, the squared norm of the n-th row of P is P^ w = j- H V ^ W 5 W = 

( H p v = ||iJ|| = Ij so P corresponds to a classical random walk. □ 



Remark 2. Szegedy's Theorem ?, wit MClaim 81 serves as a general method for relating an arbitrary 



continuous-time quantum walk on G's vertices into a coined discrete-timed quantum walk on directed 
edges of G. In particular, the eigenvalues of the discrete walk —ill are given by — + i\ a 

^giarcsmAa an( j _ g -iarcsm A a j w fi ereas ffi e continuous walk e lM has eigenvalues e lXa . The spectral 
gaps from zero of the continuous walk and the discrete walk are equal up to third order. 



6 The algorithm 

Recall from [Definition ~3l that a NAND formula is "approximately balanced" if <r_(r) = 0(1), 
<x+(r) = O(N) and \\H\\ = 0(1). These conditions are satisfied, for example, by a balanced binary 
NAND tree, as <r_(r) < 2 and c + (r) < 2N will then both be geometric series. The definition is 
also satisfied if for a fixed (5 G (0, i], for every vertex u and every grandchild c of v, s c < (1 — /?)s„. 
Under this condition, cr_(r) = O(^) and cr + (r) = O(^). 

Theorem 9. After efficient (i.e., poly(A r ) time) classical preprocessing of the size-N formula ip 
independent of x, <p(x) can be evaluated with error < 1/3 using AT2+°( 1 /v / ^W) queries to U x . 
The running time is also _/V2+°( 1 /v /1 °g A assum ing unit-cost coherent (oracle) access to the prepro- 
cessed string. For a formula that is "approximately balanced" according to \Definition 3\ the query 
complexity is only 0(\< r N) and the running time is only VN(logN)°^. 



Proof. Preprocessing: 

If u- {r)\J a+(r)\H\ = N2 + ^^\ then preprocess the formula in two ways. First, expand out 
gates so each NAND gate has 0(1) fan- in. Since edge weights are all < 1, this ensures that 
\\H\\ = 0(1). Also, apply the formula "rebalancing" procedure of [BCE911 lBB94j with parameter 
k to be determined: 

Lemma 10 ( |BB94L Theorem 4]). For all k>2, one can efficiently construct an equivalent NAND 
formula if with gate fan-ins at most two and satisfying 

depth(p) < (91n2)Hog 2 iV 
size(^) < jV 1+1 /i°g 2 fc . 

Let H be the Hamiltonian corresponding to a weighted adjacency matrix of the graph according 
to IDefinition 2[ Compute a coined quantum walk operator U that corresponds to M = H/n(H) 
via ITheorem 71 (where n(H) is some upper bound on ||i?||, to ensure that all eigenvalues of M 
have |A a | < 1). Obtaining U takes a little care, since H depends on the oracle. Consider H n the 
Hamiltonian from IDefinition 2l assuming that all leaves evaluate to 0. By applying IClaim 8l as part 
of the preprocessing, we obtain a U n corresponding to H n /\\H q n\\. Let U = O x U n, where O x 
is the input phase-flip oracle; conditioned on the current vertex being a leaf i, O x adds a phase 
of (— l) Xi . Then we claim that applying ITheorem 71 to U will give H/\\H n\\. Indeed, the only 

3 The constant in the depth bound is 9 In 2 instead of the 3 In 2 in |BB94l Theorem 4] , because we lose a constant 
converting an {AND, OR, NOT} formula to a NAND formula. 
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difference between U and U n is on the \i)s for leaf vertices i with xi = 1; in U n, \i) = \i,p) (p 
being i's parent), whereas in U, \i) = \i,i) (i.e., pi^ = 1). Therefore the M from U only differs from 
H n in the coefficients involving leaves i with X{ = 1, and (i\M\p) = (i\S\p) = 0; M = H/\\H q n\\ 
as claimed. 



Algorithm: 

1. Prepare \ f") = \r",r'). 

2. "Measure the energy under H. n That is, apply quantum phase estimation to —iU = —iO x U n . 
Use precision 5 p = l/(10cr_ (r) y/a+(r)) and error probability 5 e any constant less than 1/4. 

3. Output zero if and only if the measured phase is or it. 



Figure 2] lays out the steps of the algorithm in complete detail for the case of a balanced binary 



NAND tree. We did not use lClaim 81 to derive U in Figure 2, because in this special case it is clear 



that applying ITheorem~7l to U gives H, except with larger weights to leaves evaluating to (see 
IRemark~Tj) . 



Correctness: 

The correctness follows from Theorems [2] and [7J If (f(x) = 0, then there exist two eigenvectors of U 
given by (l±iS)T\a), with eigenvalues dbi, respectively. Their overlaps with the initial state \f") are 
\{r"\(l±iS)T\a)\ = \a r » ±za r /fejr| > l/y/2 - 0{l/N 1 / 4 ). Since the norm of {l±iS)T\a) is at most 

2|||a}|| = 2, we find that the probability of outputting is at least 2(^(^ — o(l))) 2 = 1/4 — o(l). 

Conversely, if <p(x) = 1, then every eigenstate of H with support on r' or r" has energy at least 
1 / (9<t_ (r) T^/ (T+ (r)) in magnitude. Every eigenstate of U with support on \r",r') = \f") = T\r") 
must be of the form (1 + (5 a ,±S)T\X a ) = (1 + (— \ a ± iy/l — \%)S)T\\ a ) . The terms which can 
overlap T\r") are either (r"\\ a ) (via T) or (r'|A a ) (via ST). But for |A a | < l/(10cr_ (r)y/a + (r)), 
both coefficients must be zero. Therefore, our algorithm outputs with probability less than 
5 e < 1/4. This constant gap can be amplified as usual. 



Query and time complexity: 

Phase estimation requires applying O(\\H N\\/(6 p 5 e )) = 0(<r_(r)^/ 'a + (r)\\H N ||) controlled-?/ 
evolutions |CEMM98] . For an approximately balanced graph, this is 0(y/~N). For a gen- 
eral graph, the number of controlled- U applications is 0(^fs^d r \\Hqn\\) due to the bounds on 
<r±(r) from IDcfinition 31 For a rebalanced formula from ILemma 101 with parameter k, this is 

1 I 1 / log 2 N 

0(N 2 21o §2fc(A;log 2 iV) 3 / 2 ) since = O(l). Set k = 2V 3 to optimize this bound to be 

0(m + ^ {3+oW)/losN ) queries to O x . 

During the preprocessing phase, for each vertex v we compute a sequence of 
0((log iV) 2 log log N) elementary gates that approximate to within 1/N the coin diffusion oper- 
ator at v, by applying the Solovay-Kitaev Theorem |KSV02| . (Using these approximations, the 
algorithm's total error probability will only increase by o(l).) Store the descriptions of these gate 
sequences in a classical string, which we assume the algorithm can access coherently at unit cost. 
The algorithm at vertex v looks up the corresponding gate sequence and applies it to the coin 
register |c). The total running time is thus only poly logarithmically larger than the number of 
queries. □ 
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7 Open problems 



We conclude by mentioning some open problems. 

• Our algorithm needs to know the full structure of the formula beforehand to determine the 
coin's bias at each internal vertex. (Coin biases are determined by the principal eigenvector 
of the graph's weighted adjacency matrix; they can also be solved for recursively from the 
leaves to r.) However, these coefficients need not be computed exactly, because there is some 
freedom in the recurrence on uq v and y\ v . It would be interesting to know if a different choice 
of coefficients, or a relaxed calculation thereof, would allow for faster preprocessing. Further- 
more, it would be interesting to know on what kinds of structured inputs the preprocessing 
can be done in time A^2+°( 1 ). 

• Some numerical simulations indicate that the formula can be evaluated by running the quan- 
tum walk from the initial state, and measuring whether the quantum state has large overlap 
with ^(l r '> r ") + \ r ": r ')) ° r {\ r> i r ") ~ \ r '' ' i r '))- If this is true, then we can avoid the phase 
estimation on top of the coined quantum walk, simplifying the algorithm. 

• What kinds of noisy oracles can this algorithm, or an extended version, tolerate? For example, 
[HMW03] extends Grover search to the case where input values are computed by a bounded- 
error quantum subroutine. 

• Are there hard instances of formulas for which the rebalancing provided by lLemma lOl is tight? 
Are these also hard instances for our algorithm? For example, the most imbalanced formula, 
ip(xi . . . xn) = x\ A(x2 A(x3 A(. . . Axj\r))), is not a hard instance. It can be rebalanced by 
a different procedure into depth O(logiV) and size 0(N log N), and can be evaluated with 
0(y/N) queries. 
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